Flow-based rate limiting
View Patent ↗A device may include logic configured to receive a packet, identify a flow associated with the packet in a flow table, and identify a rate limit associated with the flow in the flow table. A current rate associated with the flow may be calculated based on the packet. It may be determined whether the current rate associated with the flow exceeds the rate limit associated with the flow. If so, the packet may be discarded or tagged as “over limit.”
1. A method comprising:
identifying, using one or more processors, a rate limit associated with a packet,
the rate limit being identified based on:
layer 3 information included in the packet, and
layer 4 information included in the packet;
determining, using one or more processors and based on the packet, whether a memory stores an entry that identifies a flow corresponding to the packet,
the memory storing one or more entries identifying one or more flows,
the packet including at least two of a source address, a destination address, information identifying a source port, information identifying a destination port, or information identifying a protocol associated with the packet,
determining whether the memory stores the entry including:
generating a flow identifier based on the at least two of the source address, the destination address, the information identifying the source port, the information identifying the destination port, or the information identifying the protocol, and
searching the memory based on the flow identifier to determine whether the memory stores the entry;
calculating, using one or more processors, a current rate associated with the flow when the memory stores the entry,
the current rate being calculated using information, in the entry, that includes at least one of:
information identifying a quantity of packets, associated with the flow, received during a time period, or
information identifying a quantity of bytes, associated with the flow, received during the time period; and
processing, using one or more processors, the packet when the calculated current rate does not exceed the rate limit.
2. The method of claim 1 , further comprising:
when the calculated current rate exceeds the rate limit:
discarding the packet, or
appending, to the packet, information that indicates that the calculated current rate exceeds the rate limit.
3. The method of claim 1 , further comprising:
identifying a class associated with the packet based on the layer 3 information and the layer 4 information, prior to identifying the rate limit,
the rate limit being identified based on the class associated with the packet.
4. The method of claim 1 , further comprising:
creating the entry when the memory does not store the entry.
5. The method of claim 1 , where the entry further includes information identifying the time period,
the method further comprising:
receiving another packet of the flow; and
updating based on receiving the other packet:
the information identifying the time period, and
the at least one of:
the information identifying the quantity of packets, or
the information identifying the quantity of bytes.
6. The method of claim 5 , further comprising:
calculating, after receiving the other packet, an updated current rate associated with the flow,
the updated current rate being calculated based on:
the updated information identifying the time period, and
the updated at least one of the information identifying the quantity of packets or the information identifying the quantity of bytes; and
selectively:
discarding the other packet when the updated current rate exceeds the rate limit, or
processing the other packet when the updated current rate does not exceed the rate limit.
7. The method of claim 1 , where generating the flow identifier includes:
generating a hash based on the at least two of the source address, the destination address, the information identifying the source port, the information identifying the destination port, or the information identifying the protocol to obtain the flow identifier.
8. A non-transitory computer-readable medium for storing instructions, the instructions comprising:
a plurality of instructions which, when executed by one or more processors, cause the one or more processors to:
identify a rate limit associated with a packet,
the rate limit being identified based on layer 3 information included in the packet,
the packet including at least three of a source address, a destination address, information identifying a source port, information identifying a destination port, or information identifying a protocol associated with the packet;
determine, based on the packet, whether a memory stores an entry that identifies a flow corresponding to the packet,
the memory storing one or more entries identifying one or more flows,
one or more instructions, of the plurality of instructions, to determine whether the memory stores the entry including:
one or more instructions to generate a flow identifier based on the at least three of the source address, the destination address, the information identifying the source port, the information identifying the destination port, or the information identifying the protocol, and
one or more instructions to search the memory based on the flow identifier to determine whether the memory stores the entry;
calculate a current rate associated with the flow when the memory stores the entry,
the current rate being calculated using information, in the entry, that includes:
information identifying a time period, and
at least one of:
information identifying a quantity of packets, associated with the flow, received during the time period, or
information identifying a quantity of bytes, associated with the flow, received during the time period; and
process the packet when the calculated current rate does not exceed the rate limit.
9. The non-transitory computer-readable medium of claim 8 , where the instructions further comprise:
one or more instructions to identify a class associated with the packet based on the layer 3 information, prior to identifying the rate limit,
the rate limit being identified based on the class associated with the packet.
10. The non-transitory computer-readable medium of claim 8 , where the instructions further comprise:
one or more instructions to discard the packet when the calculated current rate exceeds the rate limit, or
one or more instructions to append, to the packet, information that indicates that the calculated current rate exceeds the rate limit when the calculated current rate exceeds the rate limit.
11. The non-transitory computer-readable medium of claim 8 , where the instructions further comprise:
one or more instructions to update based on another packet of the flow:
the information identifying the time period, and
the at least one of:
the information identifying the quantity of packets, or
the information identifying the quantity of bytes.
12. The non-transitory computer-readable medium of claim 11 , where the instructions further comprise:
one or more instructions to calculate an updated current rate associated with the flow,
the updated current rate being calculated based on:
the updated information identifying the time period, and
the updated at least one of the information identifying the quantity of packets or the information identifying the quantity of bytes; and
one or more instructions to process the other packet when the updated current rate does not exceed the rate limit.
13. The non-transitory computer-readable medium of claim 12 , where the instructions further comprise:
one or more instructions to discard the other packet when the updated current rate exceeds the rate limit, or
one or more instructions to append, to the other packet, information that indicates that the updated current rate exceeds the rate limit when the updated current rate exceeds the rate limit.
14. The non-transitory computer-readable medium of claim 8 , where the instructions further comprise:
one or more instructions to create the entry when the memory does not store the entry.
15. The non-transitory computer-readable medium of claim 8 , where the packet includes at least four of the source address, the destination address, the information identifying the source port, the information identifying the destination port, or the information identifying the protocol associated with the packet, and
where the one or more instructions to generate the flow identifier comprise:
one or more instructions to generate the flow identifier based on the at least four of the source address, the destination address, the information identifying the source port, the information identifying the destination port, or the information identifying the protocol.
16. A device comprising:
a memory to store instructions; and
a processor to execute the instructions to:
identify a rate limit associated with a packet,
the rate limit being identified based on layer 3 information included in the packet,
the packet including at least three of a source address, a destination address, information identifying a source port, information identifying a destination port, or information identifying a protocol associated with the packet,
determine, based on the packet, whether the memory stores an entry that identifies a flow corresponding to the packet,
the memory storing one or more entries identifying one or more flows,
when determining whether the memory stores the entry, the processor is to:
generate an identifier based on the at least three of the source address, the destination address, the information identifying the source port, the information identifying the destination port, or the information identifying the protocol, and
search the memory based on the identifier to determine whether the memory stores the entry,
calculate a current rate associated with the flow when the memory stores the entry,
the current rate being calculated using information, in the entry, that includes:
information identifying a time period, and
at least one of:
information identifying a quantity of packets, associated with the flow, received during the time period, or
information identifying a quantity of bytes, associated with the flow, received during the time period, and
discard the packet when the calculated current rate exceeds the rate limit.
17. The device of claim 16 , where the processor is further to:
process the packet when the calculated current rate does not exceed the rate limit.
18. The device of claim 16 , where the processor is further to:
create the entry when the memory does not store the entry.
19. The device of claim 16 , where the processor is further to:
identify a class associated with the packet based on the layer 3 information,
where the rate limit is identified based on the class associated with the packet.
20. The device of claim 16 , where the processor is further to:
update based on another packet of the flow:
the information identifying the time period, and
the at least one of:
the information identifying the quantity of packets, or
the information identifying the quantity of bytes,
calculate an updated current rate associated with the flow,
the updated current rate being calculated based on:
the updated information identifying the time period, and
the updated at least one of the information identifying the quantity of packets or the information identifying the quantity of bytes; and
selectively:
process the other packet when the updated current rate does not exceed the rate limit, or
discard the other packet when the updated current rate exceeds the rate limit.